Loading vulnerability…
CVE-2026-36239 is a code injection vulnerability in PbootCMS v3.2.11 affecting the site configuration functionality. Based on the provided content, attacker-controlled input supplied through administrative or site configuration features is insufficiently neutralized before being interpreted in a code context, enabling injection of arbitrary code into the affected application. The available information does not identify the exact vulnerable function or code path beyond the site configuration component.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone proof-of-concept for CVE-2026-36239, an authenticated RCE in PbootCMS v3.2.12. The repo contains three files: a GPL license, a README describing the vulnerability and exploitation flow, and a single Python exploit script (poc.py). The exploit is not part of a larger framework. The Python script uses the requests library and hardcoded values for the target URL, session cookies, headers, and payload. Its workflow is straightforward: first, it sends an authenticated POST request to /admin.php?p=/Site/mod to update site configuration and place attacker-controlled PHP code into the copyright/footer field; second, it sends a GET request to /admin.php?p=/Index/clearCache to force the application to reprocess cached templates. According to the README, when a frontend page containing the {pboot:sitecopyright} tag is rendered, the vulnerable decode_string() handling restores executable PHP and causes server-side execution. Main exploit capability: authenticated server-side code execution via backend content injection. The included payload writes shell.php to the web root, effectively demonstrating arbitrary file write and web shell deployment. A commented alternative payload shows command execution via system('ls'). Because the payload is hardcoded and basic, the exploit is best classified as OPERATIONAL rather than WEAPONIZED. Fingerprintable observables include the hardcoded target host http://192.168.1.10:8890, the admin endpoints /admin.php?p=/Site/mod and /admin.php?p=/Index/clearCache, referer paths used by the script, the vulnerable source path /apps/home/controller/ParserController.php, and the dropped file shell.php. Overall, this repository’s purpose is to demonstrate and automate authenticated exploitation of the vulnerable PbootCMS backend configuration workflow to achieve PHP code execution on the server.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.